feat(boards): share boards by role and keep project settings per member

docs/src/content/docs/Users Guide/06.Gallery/gallery-reference.mdx

@@ -1,7 +1,7 @@
 ---
 title: Gallery Reference
 description: Details of the Gallery — the board menu, archiving, downloading and deleting boards, the media menu, Gallery settings and keyboard shortcuts.
-lastUpdated: 2026-10-05
+lastUpdated: 2026-10-10
 sidebar:
   order: 2
 ---
@@ -22,14 +22,17 @@ Hover over a board and click its **⋮** button, or right-click it, to open its
 
 <Image src={boardMenu} alt="The board menu with Auto-add to this board, Download Board, Rename board, Archive Board and Delete Board." width={420} />
 
-* **Auto-add to this board** — makes this the board that receives new results, marked **Auto**, whichever board is selected. On the auto-add board, the item is **Stop auto-adding here**, which goes back to sending results to the selected board. Not offered for date boards or archived boards. See [Choosing where new media goes](/users-guide/gallery/introduction/#choosing-where-new-media-goes).
+* **Auto-add to this board** — makes this the board that receives new results, marked **Auto**, whichever board is selected. On the auto-add board, the item is **Stop auto-adding here**, which goes back to sending results to the selected board. Not offered for date boards, archived boards or boards you can only view. See [Choosing where new media goes](/users-guide/gallery/introduction/#choosing-where-new-media-goes).
 * **Download Board** — downloads the board (see [below](#downloading-a-board)).
 * **Rename board** — opens a dialog to change the name.
-* **Move to…** — moves the board to the **Library**, into the open project, or into one of your other projects. A board in a project is private to you, so this is offered only for your own private boards: a shared or public board stays in the **Library**, and an administrator cannot move another person's boards. You can also drag the board onto another group: the open project's, the **Library**, or one of your projects under **Other projects**. When the board's new project is hidden because **Other projects' boards** is off: if it was the selected board, the Gallery selects **Uncategorized**; if it was the auto-add board, results follow the selected board again.
+* **Access** — on a multi-user installation, who else can open the board: **Restricted**, **Everyone can view** or **Everyone can contribute**. Only the board's owner and administrators see it. See [Image Boards](/configuration/multi-user-mode/user-guide/#image-boards).
+* **Move to…** — moves one of your own boards to the **Library**, into the open project, or into one of your other projects; an administrator cannot move another person's boards. A board keeps its general access when it moves. You can also drag your board onto another group: the open project's, the **Library**, or one of your projects under **Other projects**. When the board's new project is hidden because **Other projects' boards** is off: if it was the selected board, the Gallery selects **Uncategorized**; if it was the auto-add board, results follow the selected board again.
 * **Archive Board** / **Unarchive Board** — see [below](#archiving-a-board).
 * **Delete Board** — see [below](#deleting-a-board).
 
-A project's **Inbox** is managed through its project: its menu has **Export project (.invk)**, **Auto-add to this board** and **Download Board** instead, and renaming the project renames it. **Uncategorized** offers only **Auto-add to this board** and **Download Board**, and date boards have no menu. If the auto-add board is deleted, results go back to following the selected board. The same happens when you open a project after a board it used was deleted elsewhere — in another tab, or together with a project deleted from the Launchpad: the project stops selecting it, auto-adding to it and sending queued results to it.
+On a board someone else owns, the menu starts with whose board it is and what you can do there, and it offers only what your role allows. A viewer can download the board; a contributor can also make it the auto-add board; an editor can also rename and archive it. Only the owner and administrators share or delete it, and only the owner moves it between the Library and their projects.
+
+A project's **Inbox** is managed through its project: its menu has **Export project (.invk)**, **Auto-add to this board** and **Download Board** instead, and renaming the project renames it. **Uncategorized** offers only **Auto-add to this board** and **Download Board**, and date boards have no menu. If the auto-add board is deleted or archived, results go back to following the selected board. The same happens when you open a project after a board it used was deleted elsewhere — in another tab, or together with a project deleted from the Launchpad — or after you lost access to it: the project stops selecting it, auto-adding to it and sending queued results to it.
 
 ### Archiving a board
 

docs/src/content/docs/Users Guide/06.Gallery/introduction.mdx

@@ -1,7 +1,7 @@
 ---
 title: Organizing your media
 description: Use the Gallery to organize images and videos into boards, choose where new results go, search by metadata or by content, upload media, and move, star, download or delete it.
-lastUpdated: 2026-10-05
+lastUpdated: 2026-10-10
 sidebar:
   order: 1
 ---
@@ -32,7 +32,7 @@ The Gallery has three parts:
 
 When the Gallery is narrow, or docked in a side rail, the board list sits above the media grid. When it is wide, the board list becomes a column on the left. Drag the divider between them to resize the list.
 
-Each board shows its cover image, its name and a count such as **76 | 12**: 76 items on the Media tab and 12 on the Uploads tab. A project's Inbox is pinned at the top of its group with an inbox icon. On a multi-user installation, other people's boards show their owner's name.
+Each board shows its cover image, its name and a count such as **76 | 12**: 76 items on the Media tab and 12 on the Uploads tab. A project's Inbox is pinned at the top of its group with an inbox icon. On a multi-user installation, boards other people let you open are listed under **Shared with me**, each with its owner and what you can do, such as **Ana · Can view**; administrators also see **Other users' boards**.
 
 ## Boards
 
@@ -50,7 +50,8 @@ The new board is selected straight away, so it also becomes the destination for
 
 * A new project starts with its Inbox selected. See [Projects](/users-guide/projects/introduction/#where-your-images-go).
 * If you select a date board (see below), results go to the project's Inbox, because date boards are only a view.
-* Uploads go to the selected board.
+* If you select a board someone else shares with you that you can only view, results go to the project's Inbox, which is marked **Auto** while that board is selected; the same goes for an auto-add board you can no longer add to.
+* Uploads go to the selected board; a board you can only view takes no uploads.
 * If you archive or delete the selected board, the selection, and with it the destination, moves to **Uncategorized**.
 
 To keep sending results to one board while you browse others, make it the **auto-add board**: choose **Auto-add to this board** from its menu. The board is marked **Auto**, and new generations, Canvas saves, pasted media and the results of workflow nodes whose **Board** is set to **Auto** all go there, whichever board you are viewing. Choose **Stop auto-adding here** from the same menu to go back to following the selected board. The setting behind this is **Send new results to the selected board**, in the [Gallery settings](/users-guide/gallery/gallery-reference/#gallery-settings).

docs/src/content/docs/configuration/Multi-User Mode/admin-guide.mdx

@@ -167,6 +167,28 @@ invokeai-web
 A utility to migrate legacy "system"-owned assets to specific user accounts will be available in a future release. Until then, administrators can access and manage all legacy content.
 :::
 
+### Upgrading to 7.0
+
+Upgrading converts board sharing and projects in place. The upgrade logs a warning for anything it
+had to change beyond that:
+
+- **A project id held by more than one account.** Project ids are now unique across accounts. The
+  oldest project keeps its id; each other one gets a new id, and the log names the account's id and
+  the new project id. The project's document, boards, media, queue items and the account's open
+  projects follow it. A browser tab that was open on the project still knows it by its old id, so
+  the edits it had not yet synced come back as a project-deleted conflict: export them first if they
+  are wanted, then open the project again from the Launchpad.
+- **Boards in a project that no longer exists.** A board can name a project its owner no longer has,
+  for example a board of an account deleted before the upgrade. The upgrade moves such boards out of
+  the project and logs how many there were.
+
+Board visibility becomes general access: private boards are **Restricted**, shared boards **Everyone
+can view**, and public boards **Everyone can contribute**, so every user can add media to them and
+remove only what they added. In the Gallery, an administrator sees boards other users have not
+opened to them under **Other users' boards**, closed until opened, and can manage them from their
+menus as before,
+except that only a board's owner can move it between the Library and their projects.
+
 ## User Management
 
 ### Creating Users
@@ -220,8 +242,9 @@ If no arguments are provided, the script will run in interactive mode.
 ```
 
 :::danger[Data Loss]
-Deleting a user removes the user record and cascades to their sessions, board shares, sent
-invitations, and per-user client state. It does **not** delete the boards, images, videos,
+Deleting a user removes the user record and cascades to their sessions, board memberships, sent
+invitations, projects, and per-user client state. Their boards leave the deleted projects and stay
+in no project. It does **not** delete the boards, images, videos,
 workflows, queue items, or style presets they created — those rows remain in the database, owned by
 a user_id that no longer exists, and will not appear in other (non-admin) users' galleries.
 Administrators keep gallery visibility of the orphaned images and videos and can review or delete

docs/src/content/docs/configuration/Multi-User Mode/api-guide.mdx

@@ -528,7 +528,7 @@ Resources are now filtered by the authenticated user:
 GET /api/v1/boards/?all=true  # Returns all boards
 
 # After (multi-user)
-GET /api/v1/boards/?all=true  # Returns boards the current user can access, including their own boards plus shared/public boards; admins can see all boards
+GET /api/v1/boards/?all=true  # Returns boards the current user can access, including their own boards, boards they are a member of and boards with general access; admins can see all boards
 ```
 
 **Images:**
@@ -551,6 +551,9 @@ GET /api/v1/workflows/
 # Regular users see their own queue items in full and may see redacted details for other users' items on queue-status endpoints
 GET /api/v1/queue/...  # Queue data, sanitized for non-admin viewers
 
+# With origin_prefix, item_ids, current, next and status cover only the caller's own items
+GET /api/v1/queue/{queue_id}/status?origin_prefix=webv2:p:<project_id>:q:
+
 # Administrators see all queue items in full
 GET /api/v1/queue/...  # Full queue data
 ```
@@ -838,6 +841,10 @@ On an error, it returns `422 Unprocessable Content` and  the following JSON:
 }
 ```
 
+### Board Endpoints
+
+Boards are available to every authenticated user; what each caller may do to one is decided by their role on it.
+
 #### List Image Boards
 
 **Endpoint:** `GET /api/v1/boards/`
@@ -859,7 +866,11 @@ On an error, it returns `422 Unprocessable Content` and  the following JSON:
       "deleted_at": "2026-05-07T03:04:00.738Z",
       "cover_image_name": "string",
       "archived": false,
+      "general_access": "restricted",
       "board_visibility": "private",
+      "my_role": "owner",
+      "allowed_actions": ["read", "add_media", "manage_items", "rename", "set_cover", "archive", "set_general_access", "move", "delete"],
+      "admin_override": false,
       "image_count": 0,
       "asset_count": 0,
       "owner_username": "string"
@@ -869,11 +880,20 @@ On an error, it returns `422 Unprocessable Content` and  the following JSON:
 ```
 
 This returns a paged response. See the swagger page (`http://localhost:9090/docs#/boards/list_boards`) for details.
-The `board_visibility` field will be one of:
+Each board describes the caller's access to it:
 
-- `private` -- private to the owner and administrator
-- `shared` -- read/write to the owner and administrator, read-only to everyone else
-- `public` -- read/write by everyone
+- `general_access` -- the role every other user gets: `restricted` (none), `viewer` or `contributor`. Only the owner or an administrator may change it, with `PATCH /api/v1/boards/{board_id}`.
+- `my_role` -- the caller's own role: `viewer`, `contributor`, `editor` or `owner`; `null` when only administrator rights give access.
+- `allowed_actions` -- the board actions the caller may take. Clients should decide what to offer from this list rather than from `my_role`.
+- `admin_override` -- `true` when administrator rights give the caller more than `my_role` does.
+- `owner_username` -- the owner's display name. Administrators see the email of an owner without one; other users see `Unknown user`.
+- `project_id` -- shown only to the board's owner and administrators. An image or video DTO's `project_id` likewise names the project it was made in only to that project's owner and to administrators; everyone else reads `null`.
+
+Only a board that does not exist answers `404`. A board the caller cannot open answers `403` with `Not authorized to access this board`, and an action the caller's role does not allow answers `403` too: a refusal can be reversed by the board's owner, so clients must not treat it as the board being gone. A project's inbox refuses renaming, archiving, moving, deleting and a change of general access with `409`; those follow its project.
+
+:::caution[Deprecated]
+`board_visibility` is `general_access` under its pre-7.0 name (`private` = `restricted`, `shared` = `viewer`, `public` = `contributor`). It is still returned and accepted on update, but sending it together with `general_access` is refused with `422`. It will be removed in 8.0.
+:::
 
 #### Get One Board
 
@@ -891,13 +911,29 @@ The `board_visibility` field will be one of:
   "deleted_at": null,
   "cover_image_name": "08689e4b-f084-4c49-83a8-4fc1edb167c4.png",
   "archived": false,
+  "general_access": "viewer",
   "board_visibility": "shared",
+  "my_role": "viewer",
+  "allowed_actions": ["read"],
+  "admin_override": false,
   "image_count": 55,
   "asset_count": 0,
-  "owner_username": null
+  "owner_username": "Sam"
 }
 ```
 
+### Project Endpoints
+
+Projects are private to the account that created them. The full save protocol, including the content and workspace halves and the schema floors, is described in [Project Files (.invk)](/development/front-end/project-files/).
+
+#### Save a Project
+
+**Endpoint:** `PUT /api/v1/projects/{project_id}`
+
+Saves the project's content and answers with the record and `workspace`. The optional `workspace` field (`{data, expected_revision}`) stores the caller's workspace in the same transaction and is for the save that splits a whole project (document schema 3 or older) into content and workspace: the raised document floor, the content and the first workspace row then land together or not at all. Its revision is checked as on `PUT /api/v1/projects/{project_id}/workspace`, and a mismatch refuses the whole save with `409` and the workspace's `current_revision`. Omit it on every other save: a `workspace` sent with a save that leaves the document floor below 4 is refused with `400` and the code `workspace_needs_split_document`. The split cannot go without it either: a save that raises the floor from below 4 to 4 or above without `workspace` is refused with `400` and the code `split_needs_workspace`, so the split of a whole project never lands without the caller's workspace.
+
+Workspace saves declare `max_canvas_schema_version` (default 2) as well as `max_document_schema_version`; a client below the project's canvas floor gets `412` with the code `canvas_schema_unsupported`.
+
 
 ## Best Practices